diff --git a/weed/s3api/s3api_put_object_helper.go b/weed/s3api/s3api_put_object_helper.go
index cc0d7b1c72..12a861ddf3 100644
--- a/weed/s3api/s3api_put_object_helper.go
+++ b/weed/s3api/s3api_put_object_helper.go
@@ -42,7 +42,7 @@ func getRequestDataReader(s3a *S3ApiServer, r *http.Request) (io.ReadCloser, s3e
 
 	expected, valid := expectedContentSha256(r)
 	if !valid {
-		return nil, s3err.ErrContentSHA256Mismatch
+		return nil, s3err.ErrInvalidArgument
 	}
 	if expected != nil && dataReader != nil {
 		if r.ContentLength == 0 {
diff --git a/weed/s3api/s3api_put_object_helper_test.go b/weed/s3api/s3api_put_object_helper_test.go
index 355a5984c1..9328bb3db3 100644
--- a/weed/s3api/s3api_put_object_helper_test.go
+++ b/weed/s3api/s3api_put_object_helper_test.go
@@ -299,6 +299,12 @@ func TestGetRequestDataReaderEmptyBodyHash(t *testing.T) {
 		t.Fatalf("empty body with wrong hash: code=%v", code)
 	}
 
+	malformed := httptest.NewRequest("PUT", "/b/o", strings.NewReader("x"))
+	malformed.Header.Set("X-Amz-Content-Sha256", "nothex")
+	if _, code := getRequestDataReader(s3a, malformed); code != s3err.ErrInvalidArgument {
+		t.Fatalf("malformed sha256 header: code=%v", code)
+	}
+
 	emptySum := sha256.Sum256(nil)
 	match := httptest.NewRequest("PUT", "/b/dir/", http.NoBody)
 	match.Header.Set("X-Amz-Content-Sha256", hex.EncodeToString(emptySum[:]))